Privacy Policy
Pangify is an expense-sharing app operated by Jeyakumaran. This policy explains what information we handle when you use the app at pangify.itsjaggu.com, including when you sign in with Google.
Information we collect
- Account information: your display name, email address, email-verification status, and a salted password hash if you use password login. We do not store your password in readable form.
- Google account information: when you choose Google sign-in or connect Google, we access your name, email, verified-email status, and Google's account identifier. We store these fields as needed to create or identify your account. We do not store your Google profile photo or ask for access to Gmail messages, Google Drive files, contacts, or calendars.
- Group information: trip names, currency, members, roles, expenses, expense shares, recorded repayments, and receipt images you or group members provide.
- Invitations and authentication: recipient email addresses, hashed session/verification/invitation tokens, expiry times, and temporary security records used to limit abusive requests.
- Technical information: network addresses and request details may be processed by the app and hosting infrastructure for delivering requests, security, and diagnosing failures. Server logs can include requested URLs; avoid sharing links containing authentication or invitation secrets.
How we use information
We use this information to authenticate you, connect your login methods, display your profile and trips, calculate balances, share expenses with your groups, deliver invitations and verification messages, operate backups, and protect the service. Google authorization codes and access tokens are used during sign-in and are not retained as long-term Google API credentials. We do not request a Google refresh token.
We do not sell personal information, serve advertisements, or use Google account data for advertising, credit scoring, or training general-purpose AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including applicable Limited Use requirements.
What other users can see
Your name and email address are searchable by other signed-in platform users so they can select you when creating a trip. Someone selecting you can add you to a group immediately and send you an email; accepting that email is not required for access to a group created this way.
Members of the same group can view its member names, expenses, shares, balances, repayments, and uploaded receipts. Current admin and member roles have the same group-editing permissions. Valid invitation links allow others to join after signing in. Share links and receipts carefully; avoid uploading unnecessary personal or payment-card details. A person who receives an invitation email sees the trip name and inviting user's name in the message.
Service providers and access
- Google handles optional Google authentication. The app also loads fonts from Google Fonts, which receives the browser's font-related network requests. These public policy pages use system fonts.
- DigitalOcean hosts the app and PostgreSQL database in Bangalore, India, and provides infrastructure backups.
- Resend delivers verification and invitation emails and processes recipient addresses, message content, and delivery information.
These providers process information under their own service terms and policies and may process data outside India. The app operator may access data when necessary to operate the service, handle support or privacy requests, investigate security problems, or comply with applicable law. We may disclose information if legally required. We do not share your password or Google login credentials with group members.
Cookies and browser storage
We use an essential session cookie to keep you signed in and temporary cookies for Google sign-in and password confirmation. Production authentication cookies use HttpOnly and Secure protections. The app uses browser session storage to retain pending trip invitations across redirects. It may also read an old locally stored trip link for migration. The app does not use advertising trackers or an analytics SDK. Signing out clears the current session cookie; clear browser storage if you also want to remove saved invitation links.
Retention, correction, and deletion
Account and shared trip data remain stored while needed to provide the service, unless removed in response to a request or for another operational or legal reason. There is no automatic account-expiry schedule. Authentication and invitation tokens expire; expired token records may remain until cleanup runs. Daily database dumps are normally removed after they are older than 14 days. Infrastructure backups and any off-server recovery copies follow their configured retention and may remain longer.
You can update your display name from your profile. To request access, correction, account deletion, or removal of personal information, email ma.jeyakumaran@gmail.com. We may need to verify that the request is from the account owner. There is no self-service account-deletion button yet. We will review how to remove or anonymize your account information while preserving other members' shared expense history where appropriate or required. Deletion from the live app does not immediately remove existing recovery backups; those copies are removed as their retention periods end. We will explain any data we need to retain when handling your request.
You can revoke Pangify's access through your Google Account's third-party connections settings. Revoking Google access does not itself delete your Pangify account or group records. If you set a password, you can continue signing in with it.
Security and changes
We use HTTPS, password hashing, private database networking, and membership checks to protect the service. No online service can guarantee absolute security. Contact us if you suspect unauthorized access. We will update this page when our practices change and give additional notice or request consent when required, including before using Google data for a new purpose.
Contact
Operator: Jeyakumaran
Privacy and support:
ma.jeyakumaran@gmail.com